
<!DOCTYPE html>
<html lang="ja">

<head>
<meta charset="utf-8">
<title>Shellcoder&#039;s Challenge!</title>
<script type="text/javascript" src="jquery-1.10.2.min.js"></script>
<script type="text/javascript">

var LEVEL = "3";

function auth()
{
	document.getElementById("titl").innerHTML = "Level " + LEVEL;
	
	$.post('cgi-bin/auth.py',
		{
		'user': "",
		'pass': ""
		}, 
		function(data)
		{
			result = data.substring(0, 2);
			if(result != "ok"){
				location.href="login.html";
			}
		}
	);

	$.get('cgi-bin/check.py',
		{
		},
		function(data)
		{
			result = data.substring(0, 2);
			if(result == "lo"){
				location.href = "login.html";
			}else{
				var ll = data.split(",");
				for(var i=1; i < ll.length; i++){
					if(ll[i] == LEVEL){
						var old = "Level " + LEVEL +" <font color=\"#ff0000\">★</font>";
						document.getElementById("titl").innerHTML = old;
					}
				}
			}
		}
	);
}
function check()
{
	$.post('cgi-bin/q.py',
		{
		'level' : "l" + LEVEL,
		'answer': document.getElementById("answer").value
		},
		function(data)
		{
			result = data.substring(0, 2);
			if(result == "ok"){
				txt = "<font color=\"#ff0000\">correct!</font>";
				document.getElementById("mes").innerHTML = txt;
				auth();
			}else if(result == "lo"){
				location.href = "login.html";
			}else{
				txt = "<font color=\"#000000\">incorrect...</font>";
				document.getElementById("mes").innerHTML = txt;
			}
		}
	);
}
</script>
</head>

<body onload="javascript:auth()">
<a href="http://www.seccon.jp/">
<img src="" width="191" height="34" alt="SECCON" border="0">
</a>

<h1>Shellcoder&#039;s Challenge!</h1>

<table border="0" width="600">
<tr valign="top">
<td>

<table border="0">
<tr><td>Answer:</td><td><input type="text" id="answer" value="">
  <input type="button" value=" submit " onclick="javascript:check()">
</td></tr>
<tr><td></td><td id="mes">input your answer...</td></tr>
</table>

<h3 id="titl"></h3>

<p>
このライブラリ関数の名前（関数名）を答えよ。
</p>

<pre>
0805c6a8 &lt;function&gt;:
 805c6a8:  53           push   %ebx
 805c6a9:  8b 44 24 08  mov    0x8(%esp),%eax
 805c6ad:  8a 4c 24 0c  mov    0xc(%esp),%cl
 805c6b1:  90           nop    
0805c6b2 &lt;L1&gt;:
 805c6b2:  8a 18        mov    (%eax),%bl
 805c6b4:  38 d9        cmp    %bl,%cl
 805c6b6:  74 07        je     805c6bf &lt;L2&gt;
 805c6b8:  40           inc    %eax
 805c6b9:  84 db        test   %bl,%bl
 805c6bb:  75 f5        jne    805c6b2 &lt;L1&gt;
 805c6bd:  31 c0        xor    %eax,%eax
0805c6bf &lt;L2&gt;:
 805c6bf:  5b           pop    %ebx
 805c6c0:  c3           ret    
</pre>

<p>
Hint1: 文字列を扱う関数です<br>
Hint2: 渡される引数は2つ 0x8(%esp) と 0xc(%esp) に入っています
</p>

</td>

</tr>
</table>

</body>
</html>

